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MEMORANDUM OPINION 


I. INTRODUCTION 

Plaintiffs Dave Levinthal and the Center for Public Integrity bring this suit under the 
Freedom of Information Act (“FOIA”). On July 6, 2015, Plaintiffs submitted a FOIA request to 
Defendant Federal Election Commission seeking: (1) a copy of a study that assesses 
vulnerabilities in the Commission’s information technology (“IT”) systems and makes 
recommendations to address those vulnerabilities; and (2) any emails and documents related to the 
study. Defendant produced non-exempt materials related to the study, but withheld the study itself. 
Plaintiffs brought this suit claiming that Defendant violated FOIA by failing to produce the study. 

Upon consideration of the parties’ submissions and the record evidence, the court grants 
Defendant’s Motion for Summary Judgment and denies Plaintiffs’ Cross-Motion for Summary 
Judgment. 



II. BACKGROUND 


As required by Local Civil Rule 7(h)(1), Defendant Federal Election Commission 
(“Commission” or “Defendant”) submitted a detailed statement of undisputed material facts. 

SedDef.’s Mot. for Summ. J., ECF No. 13 [hereinafter Def.’s Mot.], Def.’s Stmt, of Material Facts, 

ECF No. 13-1 [hereinafter Def.’s Stmt.]. Plaintiffs, for their part, responded with a bare-boned 
counter-statement that did not dispute Defendant’s factual assertions. Pis.’ Cross-Mot. for Summ. 

J., ECF No. 14 [hereinafter Pis.’ Mot.], Pis.’ Stmt, of Material Facts, ECF No. 14-1 [hereinafter 
Pis.’ Stmt.]. 1 Accordingly, the court treats Defendant’s proffered facts, recited below, as conceded 
by Plaintiffs. See SEC V. Banner Fund // Itl F.3d 602, 616 (D.C. Cir. 2000) (“If the party 
opposing the motion fails to comply with [the] local rule, then ‘the district court is under no 
obligation to sift through the record’ and should ‘[i]nstead . . . deem as admitted the moving party’s 
facts that are uncontroverted by the nonmoving party’s Rule [LCvR 7.1(h)] statement.’” 

(alterations in original) (quoting Jackson v. Finnegan, Henderson, Farabow, Garrett & Dunner 
101 F.3d 145, 154 (D.D.C. 1996)). 

A. Factual Background 

In Fiscal Year 2014, the Commission hired an outside contractor, SD Solutions, LLC, to 
determine whether there were vulnerabilities in the Commission’s IT systems and, if there were, 
to provide remedial recommendations. Def.’s Stmt. U 5; Def.’s Mot., Decl. of Alec Palmer, ECF 
No. 13-2 [hereinafter Palmer Decl.], U 7. The Commission ordered the study to assist it in deciding 
whether to implement newly developed information security guidelines published by the U.S. 
Department of Commerce’s National Institute of Standards and Technology (“NIST”). Def.’s 

1 Plaintiffs later submitted a more fulsome statement of facts with their Reply Brief^eePls.’ Reply, ECF No. 18, Pis.’ 

Stmt, of Genuine Issues of Fact, ECF No. 18-1, but that statement came too late,seeLCvR 7(h)(1) (“T]he Court may 
assume that facts identified by the moving party in its statement of material facts are admitted, unless such a fact is 
controverted in the statement of genuine issues filed in opposition to the mOfflMphasis added)). 
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Stmt, H 6; Palmer Decl. H 7. In preparing its report, SD Solutions examined the Commission’s 
“physical and virtual information technology assets” and recommended measures for the 
Commission to protect its infrastructure from “wrongful interference, circumvention, or unlawful 
action by unauthorized persons.” Palmer Decl. H 8. Furthermore, it assessed the “vulnerabilities 
to unlawful breach present in the Commission’s technological infrastructure, describing sensitive 
Commission systems and recommending specific security measures to address the vulnerabilities.” 
Id. The Commission refers to SD Solutions’ final report and its related documents, collectively, 
as the “NIST Study.” Def.’s Stmt. H 8; Palmer Decl. H 18. 

The NIST Study consists of two parts. The first part is an overview memorandum prepared 
by the Commission’s Office of the Chief Information Officer. The overview memorandum lists 
measures the Office has used in the past to address IT vulnerabilities, summarizes SD Solutions’ 
final report, and discusses “the practicalities of implementing the [NIST] guidelines should the 
Commission adopt the recommendations in the Final Report.” Def.’s Stmt. H 10; Palmer Decl. 
ffll 2, 9, 10. The overview memorandum includes two appendices: (1) an abridged version of the 
full final report, and (2) a summary of both the recommendations in the report and the personnel 
and financial resources that would be required to satisfy each recommendation. Id. HU 10, 11. 

The second part of the NIST Study is the final report itself. As discussed, the report 
describes the Commission’s IT network, assesses the security of each system and identifies the 
vulnerabilities therein, and contains recommendations for security measures to address the 
identified vulnerabilities, /of. HU 12, 14. 

B. Procedural Background 

Plaintiff Dave Levinthal is an investigative journalist employed by Plaintiff the Center for 
Public Integrity. Seffls.’ Mot. at 1; Def.’s Mot. at 3; Def.’s Stmt. H 4. On July 6, 2015, Plaintiffs 
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submitted a FOIA request to the Commission, seeking: (1) “a copy of the 2015 National Institute 
of Standards and Technology Report—also known as the NIST study—pertaining to the Federal 
Election Commission’s operations,” and (2) “any FEC emails, memoranda, correspondence or 
other documents that, in any form or fashion, mention or refer to this National Institute of 
Standards and Technology report, by name or otherwise.” Def.’s Stmt. U 38; Def.’s Mot., Deck of 
Robert M. Kahn, ECF No. 13-3 [hereinafter Kahn Deck], U 6 & Ex. A [hereinafter FOIA Request]. 

On August 18, 2015, the Commission denied Plaintiffs’ request for a copy of the NIST 
Study, but granted their request for documents that mention or refer to the study, subject to 
applicable FOIA exemptions. Kahn Deck U 7 & Ex. C (Email from Robert M. Kahn to Dave 
Levinthal (Aug. 18, 2015)). The Commission eventually produced more than 1,450 pages of non¬ 
exempt records, and non-exempt portions of records, that mentioned or referred to the NIST Study. 
Jt. Status Rep., ECF No. 11. 

Plaintiffs filed an administrative appeal challenging the decision to withhold the NIST 
Study, asserting that it “is likely to contain information that directly benefits the public’s 
understanding of Federal Election Commission capabilities and operations during a high-profile 
election season.” Kahn Deck t 8 & Ex. C. In September 2015, the Commission denied Plaintiffs’ 
appeal. Id. U 10 & Ex. F (Email from Robert M. Kahn to Dave Levinthal (Sept. 30, 2015)). 

Plaintiffs filed their Complaint in this court on October 5, 2015, challenging only 
Defendant’s non-disclosure of the NIST Study. SeeComph, ECF No. 1. On March 17, 2016, 
Defendant filed a Motion for Summary Judgment, claiming that the NIST Study is exempt from 
disclosure both as a law enforcement record under FOIA Exemption 7(E) and as deliberative 
material under FOIA Exemption 5. Def.’s Mot. at 10-21. On April 8, 2016, Plaintiffs filed a 
Cross-Motion for Summary Judgment, which contests categorizing the NIST Study as a law 
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enforcement record under Exemption 7(E). SeePls.’ Mot at 4. Additionally, although Plaintiffs 
concede the applicability of Exemption 5, they argue that the Commission has failed to meet its 
obligation under FOIA to release any “reasonably segregable non-exempt information.” Id. at 5. 

III. LEGAL STANDARD 

A court shall grant summary judgment “if the movant shows that there is no genuine 
dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. 

Civ. P. 56(a). To make this determination, the court must “view the facts and draw reasonable 
inferences in the light most favorable to the [non-moving] party.” Scott V. HarpSSO U.S. 372, 

378 (2007) (internal quotation mark omitted). A dispute is “genuine” only if a reasonable fact¬ 
finder could find for the nonmoving party, and a fact is “material” only if it is capable of affecting 
the outcome of litigation. Anderson v. Liberty Lobby,4UTc\].S. 242, 248-49 (1986). Anon- 
material factual dispute cannot prevent the court from granting summary judgment. Id. at 249. 

Most FOIA cases are appropriately decided on motions for summary judgment. 

See Defenders of Wildlife v. U.S. Borc/qr6£a©:c8hpp. 2d 83, 87 (D.D.C. 2009). A court 
may award summary judgment in a FOIA case by relying on the information included in the 
agency’s affidavits or declarations if they are “relatively detailed and non-conclusory,” SafeCard 
Servs., Inc. V. 5jQ26 F.2d 1197, 1200 (D.C. Cir. 1991) (internal quotation marks omitted), and 
if they describe “the documents and the justifications for nondisclosure with reasonably specific 
detail, demonstrate that the information withheld logically falls within the claimed exemption, and 
are not controverted by either contrary evidence in the record nor by evidence of agency bad faith,” 
Military Audit Project v. Cp36K^F.2d 724, 738 (D.C. Cir. 1981). 

The agency bears the burden of demonstrating that each FOIA exemption applies, and its 
determinations are subject to de novo review in district court. U.S. Dep't of Justice v. Reporters 
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Comm, for Freedom ofthe,RSBSS.S. 749, 755 (1989) (citing 5 U.S.C. § 552(a)(4)(B)). To 
prevail on a motion for summary judgment, the agency must demonstrate that “each document that 
falls within the class requested either has been produced, is unidentifiable, or is wholly exempt 
from the Act’s inspection requirements.” Goland V. Cent. Intelligence A§bT)W^. d 339, 352 
(D.C. Cir. 1978); see also Students Against Genocide v. Dep, '£S5fEM828, 833 (D.C. 

Cir. 2001). 

IV. DISCUSSION 

A. FOIA Exemption 7(E) 

The court first considers whether the NIST Study is exempt from disclosure under FOIA 
Exemption 7(E). Def.’s Mot at 10-17; Pis.’ Mot. at 3-4. 

Under Exemption 7(E), an agency may withhold information (1) “compiled for law 
enforcement purposes” if (2) its release “would disclose techniques and procedures for law 
enforcement investigations or prosecutions, or would disclose guidelines for law enforcement 
investigations or prosecutions,” and (3) such “disclosure could reasonably be expected to risk 
circumvention of the law.” 5 U.S.C. § 552(b)(7)(E). Exemption 7(E) “sets a relatively low bar 
for the agency to justify withholding,” Blackwell v. FB& 46 F.3d 37, 42 (D.C. Cir. 2011), and 
“where an agency ‘specializes in law enforcement, its decision to invoke [Ejxemption 7 is entitled 
to deference,”’ Lardner v. Dep't of Jgs$tiEe F. Supp. 2d 14, 31 (D.D.C. 2009) (quoting 
Campbell V. Dep’t of yi/£t&feF.3d 20, 32 (D.C. Cir. 1998)). This does not excuse an agency, 
however, from the requirement of describing its “justifications for withholding the information 
n with specific detail.” Am. Civil Liberties Union v. Dep’t 3d 612, 619 (D.C. Cir. 

2011 ). 
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In this case. Plaintiffs offer a single argument challenging Defendant’s invocation of 
Exemption 7(E): the NIST Study was not “compiled for law enforcement purposes.” Pis.’ Mot. 
at 4. 2 The court has little trouble rejecting that contention. 

A record is “compiled for law enforcement purposes” so long as there is (1) a rational 
“nexus” between the record and the agency’s law enforcement duties, and (2) a connection 
between the subject of the record and a possible security risk or violation of federal law. 

See Campbdti4 F.3d at 32; see also Pratt V. We 2d 408, 420 (D.C. Cir. 1982). The 

latter requirement must be satisfied “to establish that the agency acted within its principal function 
of law enforcement, rather than merely engaging in a general monitoring of individuals’ activities.” 
Pratt 673 F.3d at 420. The NIST Study satisfies both requirements. 

First, the NIST Study meets the rational “nexus” requirement because a federal agency, 
like the Commission, cannot effectively carry out its law enforcement function unless it has a 
secure and reliable IT system. The Commission is responsible for investigating violations of the 
Federal Election Campaign Act. SeeDef.’s Mot. at 5-6; Def.’s Stmt. KK 1-3; 52 U.S.C. 

§ 30109(a)(l)-(2). Its IT system contains sensitive information related to investigations, including 
“subpoenas, requests for information and documents, reports of investigation, and responses to 
Commission-issued subpoenas and requests.” Palmer Deck K 17. The system also contains a 
“confidential scoring system, the Enforcement Priority System, which identifies significant cases 
for enforcement!!]” Id. K 16. In short, the Commission’s IT system is central to its law 


2 The court, therefore, treats as conceded the remaining elements of Exemption 7(E)—namely, that the exempted 
record (1) “would disclose techniques and procedures for law enforcement investigations or prosecutions, or would 
disclose guidelines for law enforcement investigations or prosecutions” and (2), if disclosed, “could reasonably be 
expected to risk circumvention of the law.” 5 U.S.C. § 552(b)(7)(E). See Wilkins V. JackSZSQ F. Supp. 2d 160, 
162 (D.D.C. 2010) (“It is well established that if a plaintiff fails to respond to an argument raised in a motion for 
summary judgment, it is proper to treat that argument as conceded. ”);Sy/ces V. Du03>3 3 F. Supp. 2d 191, 202 
(D.D.C. 2008) (“[W]hen a party responds to some but not all arguments raised on a Motion for Summary ludgment, 
a court may fairly view the unacknowledged arguments as conceded.”). 
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enforcement function. See ic(“ The Commission’s information systems network allows it to fulfill 
its statutory obligation to administer and enforce campaign finance laws.”). 

The NIST Study in turn was designed to promote the integrity of that system and thus itself 
serves a law enforcement function. The study’s purpose was to “assess the vulnerabilities of the 
Commission’s information technology systems” and to make “recommendations about how the 
Commission could protect its systems from wrongful interference, circumvention, or unlawful 
action by authorized persons.” Palmer Deck Iff! 7, 8. A study designed to evaluate and improve a 
critical law enforcement tool, such as an IT system, easily meets the rational nexus requirement. 

Second, there is a connection between the NIST Study and a possible security risk or 
violation of federal law. According to the Commission’s Chief Information Officer, Alec Palmer, 
the NIST Study is the type of assessment “that, if publicly disclosed, could be used by persons 
with malicious objectives to do great harm.” Id. U 19. Palmer asserts that “information contained 
in the NIST Study could be used to gain unlawful access to the Commission’s technology systems, 
obtain and manipulate sensitive and confidential data about candidates, officeholders, party 
committees, and others who interact with the Commission, or obtain and manipulate data stored 
within the Commission’s systems regarding [Commission] enforcement matters.” Id. Further, 
Palmer explains that a person with access to the NIST Study “could use the information contained 
[therein] to seriously threaten the Commission’s ability to fulfill its civil enforcement and other 
statutory duties.” Id. Finally, Palmer attests that the NIST Study “provides a blueprint to the 
Commission’s networks” and that its public disclosure “could thus enable hackers to bypass the 
Commission’s current protection mechanisms.” Id. H 21. This court observed in Long V. 
Immigration and Customs EnforplarnsrSupp. 3d 39, 53 (D.D.c. 2015), that “[j]udges are 
not cyber specialists, and it would be the height of judicial irresponsibility for a court to blithely 
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disregard ... a claimed risk” of a cyber-attack or a security breach. The court will not disregard 
such risk in this case. Accordingly, the court finds that the NIST Study satisfies the second prong 
of the “compiled for law enforcement purposes” inquiry. 

Plaintiffs offer two rejoinders. First, they contend that the NIST Study is not “compiled 
for a law enforcement purpose” because “[i]t is not connected to an investigation.” Pis.’ Mot. at 
4. That argument misconstrues the law. The Court of Appeals consistently has held that records 
do not have to be linked to a specific investigation to be properly withheld under Exemption 7(E). 

For instance, in Tax Analysts v. Internal Revenue Servio]Se(dR3j held that IRS materials 
related to law enforcement activities “outside of the context of a specific investigation” met the 
threshold for materials “compiled for law enforcement purposes” under Exemption 7(E). Se &94 
F.3d 71, 73, 78-79 (D.C. Cir. 2002). In so holding, it observed that Congress amended 
Exemption 7 in 1986 to make clear that 7(E) “was not limited to records or information addressing 
only individual violations of the law.” Id. at 79. More recently, in Blackwell v. Federal Bureau 
of lnvestigati,ahe Court of Appeals held that the FBI had properly withheld methods of data 
collection, organization, and presentation contained in certain reports under Exemption 7(E). 646 
F.3d at 42. The methods were developed for the FBI to meet the agency’s “investigative needs,” 
rather than linked to a specific investigation. Id. 

Moreover, as Defendant correctly points out, Def.’s Mot. at 11, 13-14, courts in this 
District repeatedly have held that information connected to law enforcement databases qualifies 
for exemption under 7(E). See, e.,d)-Ong 149 F. Supp. 3d at 44 (holding that requests for metadata 
and database schema of law enforcement information databases qualify for exemption under 7(E)); 
Strunk V. U.S. Dep't of S$9SeF- Supp. 2d 142, 146-48 (D.D.C. 2012) (holding that computer 
transaction and function codes that reveal how to navigate and retrieve information from a law 
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enforcement database were properly withheld under Exemption 7(E))/W///er v. U.S. Dep't of 
Justice 872 F. Supp. 2d 12, 29 (D.D.C. 2012) (holding that numerical codes used to identify 
information and individuals, as well as codes “relatefd] to procedures concerning the use of law 
enforcement resources and databases ... [and] case program and access codes[,]” were properly 
withheld under Exemption 7(E)); Skinner V. U.S. Dep’t of Jup&ti3aF. Supp. 2d 109, 113-14 
(D.D.C. 2012) (holding that user access codes that facilitated access to a law enforcement database 
were properly redacted under Exemption 7(E )),affd sub nom. Skinner v. Bureau of Alcohol, 
Tobacco, Firearms & Explop Jtoe!2-5319, 2013 WL 3367431 (D.C. Cir. May 31, 2013)). 

Thus, the fact that the NIST Study does not pertain to a particular investigation does not place it 
outside Exemption 7(E). 

Second, Plaintiffs argue that Exemption 7(E) is inapplicable because Defendant “has not 
established that the vulnerabilities described in the NIST Study still exist.” Pis.’ Mot. at 4. More 
specifically. Plaintiffs argue that, even if Exemption 7(E) applies “to portions of the NIST Study, 
to the extent that facts on the ground have changed since the preparation of the report, disclosure 
of previous vulnerabilities would not fall under Exemption 7(E).” Id. at 5. That argument is a 
nonstarter. Again, the Palmer Declaration, which the court described above, amply supports 
Defendant’s contention that the public release of the NIST Study—or any portion of it—would 
run the risk of compromising the Commission’s law enforcement function. According to Palmer, 
if released, unauthorized readers of the NIST Study could “gain unlawful access to the 
Commission’s technology systems, obtain and manipulate sensitive and confidential data about 
candidates, officeholders, party committees, and others who interact with the Commission, or 
obtain and manipulate data stored within the Commission’s systems regarding [Commission] 
enforcement matters.” Id. H 19. Additionally, Palmer states that an unauthorized individual or 
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government armed with the NIST Study could “seriously threaten the Commission’s ability to 
fulfill its civil enforcement and other statutory duties” and “alter the disclosure data that the 
Commission makes available on its public website, thereby providing false disclosure information 
that could adversely influence the outcome of an election.” Id. 19-20. Further, disclosing the 
NIST Study could allow hackers to gain access to the Commission’s networks, enabling them to 
“distort or prevent access to campaign finance reports,” or “expose sensitive information about 
parties regulated by the Commission.” Id. UH 21, 24. Palmer’s Declaration credibly demonstrates 
that disclosure of any portion of the NIST Study would pose a present and genuine security threat 
to the Commission’s law enforcement function. Accordingly, the court rejects Plaintiffs’ argument 
that the NIST Study is not exempt under 7(E). 

B. FOIA Exemption 5 and Segregability 

Defendant also invokes FOIA Exemption 5 to withhold the NIST Study. Def.’s Mot. at 
17. Exemption 5 shields disclosure of “inter-agency or intra-agency memorandums or letters 
which would not be available by law to a party other than an agency in litigation with the agency.” 

5 U.S.C. § 552(b)(5). Exemption 5 has been interpreted to incorporate the three traditional civil 
discovery privileges—the attorney work product privilege, the deliberative process privilege, and 
the attorney-client privilege. Burka v. U.S. Dep't of Health & Human,SeiE/S d 508, 518 
(D.C. Cir. 1996). Here, Defendant asserts the deliberate process privilege as the basis for invoking 
Exemption 5. Def.’s Mot. at 17-21; see Tax Analysts V., IRS F.3d 607, 616 (D.C. Cir. 1997) 
(describing the deliberative process privilege as covering records that are both “predecisional” and 
“deliberative”). 

Plaintiffs do not contest the applicability of the deliberative process privilege to the NIST 
Study. Seffls.’ Mot. at 5 (“Plaintiffs do not doubt that the NIST Study contains predecisional 
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recommendations.”). Instead, they challenge whether Defendant has satisfied its duty to segregate 
and produce non-exempt factual material contained within the NIST Study./c/. Specifically, 

Plaintiffs argue that Defendant “has not established that [the factual material is] actually 
‘inextricably entwined’with deliberations.” Id.; see Mead Data Cent., Inc. v. U.S. Dep't of the 
Air Force 566 F.2d 242, 260 (D.C. Cir. 1977) (collecting cases and explaining that “[i]t has long 
been a rule in this Circuit that non-exempt portions of a document must be disclosed unless they 
are inextricably intertwined with exempt portions”). The court disagrees. 

Because “the focus of FOIA is information, not documents ... an agency cannot justify 
withholding an entire document simply by showing that it contains some exempt material.” Mead 
Data Cept566 F.2d at 260. FOIA therefore requires that “[a]ny reasonably segregable portion 
of [the] record shall be provided to any person requesting such record after deletion of the portions 
which are exempt.” 5 U.S.C. § 552(b). An agency must provide a “detailed justification” and not 
just make “conclusory statements” to support its segregability determination. Mead Data Cept. 

566 F.2d at 261. Agencies, however, “are entitled to a presumption that they complied with the 
obligation to disclose reasonably segregable material,” which can be overcome by contrary 
evidence produced by the requester. Sussman v. U.S. Marshals,S&4\E. 3d 1106, 1117 (D.C. 

Cir. 2007). 

The Palmer Declaration provides a “detailed justification” for the Commission’s decision 
that no part of the NIST Report is segregable, and Plaintiffs have not offered any evidence to the 
contrary. According to Palmer, the Commission’s Office of the Chief Information Officer 
conducted a line-by-line analysis of the NIST Study to determine if any portion could be 
segregated and released without jeopardizing the security of its networks. Palmer Deck 1fl[ 25-27. 

Palmer observes that the “factual descriptions of the Commission’s information technology 
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systems and their vulnerabilities in the Final Report form the basis of the Report’s analysisf] . . . 
and they reflect the need for the recommended protocols that constitute the core of the NIST 
Study.” /d.H 26. If the factual content of the NIST Study were publicly disclosed, Palmer explains, 
it “would effectively release many of the NIST Study’s recommendations, as well as the substance 
of the vulnerability analysis that [the Office of the Chief Information Officer] submitted to the 
Commission for its determination on whether to accept those recommendations.” Id. H 27. “The 
factual descriptions expose the Commission to risk of a security breach of its network and 
information technology systems.” Id. 

Palmer’s Declaration clearly establishes that the factual portions of the NIST Study are 
“inextricably intertwined” with its deliberative elements. Mead Data Ce/TS66 F.2d at 260. It 
also sets forth with “reasonable specificity” why those factual portions cannot be segregated. 
Armstrong v. Exec, office of the Pt;<35h$S/dE75, 578-79 (D.C. Cir. 1996). Accordingly, 
the court rejects Plaintiffs’ argument that Defendant has not met its duty of segregability. 

V. CONCLUSION 

For the foregoing reasons, the court grants Defendant’s Motion for Summary Judgment 
and denies Plaintiffs’ Cross-Motion for Summary Judgment. A separate final order accompanies 
this Memorandum Opinion. 

Dated: November 23, 2016 
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